Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

There has been speculation that the attack on Twitter consisted of a widely distributed e-mail containing links to the Twitter page of a blogger from Georgia (the former Soviet state).

Yet, based on available data, that theory doesn’t seem to hold up. The attack may have been designed to silence the blogger, but it is unlikely that the spam traffic amounted to much of a denial-of-service attack, according to network-traffic patterns seen by Arbor Networks, a networking services vendor. According to the company, the attack resulted not from users clicking through a link in an e-mail, but from two common types of packet floods used in more common denial-of-service attacks.

“The attack traffic is not an e-mail click but SYN floods and UDP floods going to Twitter’s space,” says Craig Labovitz, chief scientist for Arbor. “It’s stuff that does not look like it was directly tied to a click-through or e-mail attacks.”

Early on Thursday, Arbor’s network of Internet sensors could tell that traffic to Twitter had dropped by half. While the company collected a dozen or so examples of attack traffic, the company cannot tell from which sources the traffic came, Labovitz says.

Moreover, if the attack’s origin had been widespread, such as when millions of people click on links in e-mail messages, then the firm should have seen an increase in traffic to Twitter, not a decrease. The drop in traffic witnessed by Arbor and other network monitoring services indicates that the attack came from a smaller number of computers that were, in general, not visible to the vendors.

Of course, there are caveats. The link in the e-mail could have exploited an application issue in Twitter’s site to consumer an inordinate amount of resources per click-through. Alternatively, Arbor and other vendors could have failed to monitor the specific paths to Twitter through which the attacks were routed.

“Without more details, it is possible that it went along paths that we were not monitoring,” acknowledges Labovitz.

Why wasn’t Facebook as affected by the attacks as Twitter? The company has a much more robust infrastructure consisting of an Akamai-like distributed hosting service and crunches a lot more bandwidth than Twitter, says Labovitz. While Twitter typically maxes out at 300 gigabits per second, Facebook accounts for 0.5 percent of the bandwidth of the entire Internet, he says.

0 comments about this story. Start the discussion »

Tagged: Web, Twitter, hackers, DDoS

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me